docs(release): the documents say what 1.1.1 does, and the package manifests verify the file they name #199

2026-11-11T06:04:05Z

james.maes commented

2026-11-11 06:04:05 +00:00

What

Documents corrected where they no longer described the product: docs/security/threat-model.md, SECURITY.md, README.md, CONTRIBUTING.md, docs/CLI.md, docs/RELEASING.md.
.github/scripts/Update-PackageManifests.ps1 downloads the CLI zip from the URL the manifests will name and compares its SHA-256 with the built file's; before, it asked only whether the URL answers. It also writes the Scoop manifest with LF line endings.
VaultEdgeTests: the one test that stored an entry in the credential namespace of the installed app uses two test scopes instead.

Why

Closes #183. Found by the release reviews of the 1.1.1 candidate: statements that are false at this commit (the threat model said gclo contacts nothing but GitHub, and that the binaries are unsigned; SECURITY listed 1.0.x as the supported line; the README described a packaged build and a beta that is taken over by the stable installer), and a manifest check that could pass for a file that is not the one that was hashed.

How it was tested

The script was run against the existing 1.1.0 release on git.kof22.com: with the pinned hash it succeeds and leaves the manifests byte for byte as they are; with another hash it refuses and names both hashes. PSScriptAnalyzer is clean.
Gates, started from PowerShell: build with warnings as errors, both test suites with the coverage gate, format, UI suite (numbers in the comment below).

Checklist

Commits are signed and signed off (git commit -S -s)
Zero build warnings; format and lint are clean
Tests added or updated; the 100% coverage gate still passes
Docs updated for user-visible changes; threat model updated if the attack surface changed (corrections; no change of attack surface)
No secrets, credentials, or personal data
New dependencies are justified below, or none were added (none)
Substantial AI assistance, if any, is noted here: written with Claude Code, from findings of four independent review agents.

🤖 Generated with Claude Code

## What - Documents corrected where they no longer described the product: `docs/security/threat-model.md`, `SECURITY.md`, `README.md`, `CONTRIBUTING.md`, `docs/CLI.md`, `docs/RELEASING.md`. - `.github/scripts/Update-PackageManifests.ps1` downloads the CLI zip from the URL the manifests will name and compares its SHA-256 with the built file's; before, it asked only whether the URL answers. It also writes the Scoop manifest with LF line endings. - `VaultEdgeTests`: the one test that stored an entry in the credential namespace of the installed app uses two test scopes instead. ## Why Closes #183. Found by the release reviews of the 1.1.1 candidate: statements that are false at this commit (the threat model said gclo contacts nothing but GitHub, and that the binaries are unsigned; SECURITY listed 1.0.x as the supported line; the README described a packaged build and a beta that is taken over by the stable installer), and a manifest check that could pass for a file that is not the one that was hashed. ## How it was tested - The script was run against the existing 1.1.0 release on git.kof22.com: with the pinned hash it succeeds and leaves the manifests byte for byte as they are; with another hash it refuses and names both hashes. PSScriptAnalyzer is clean. - Gates, started from PowerShell: build with warnings as errors, both test suites with the coverage gate, format, UI suite (numbers in the comment below). ## Checklist - [x] Commits are signed and signed off (`git commit -S -s`) - [x] Zero build warnings; format and lint are clean - [x] Tests added or updated; the 100% coverage gate still passes - [x] Docs updated for user-visible changes; threat model updated if the attack surface changed (corrections; no change of attack surface) - [x] No secrets, credentials, or personal data - [x] New dependencies are justified below, or none were added (none) - [x] Substantial AI assistance, if any, is noted here: written with Claude Code, from findings of four independent review agents. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 1 commit 2026-11-11 06:04:05 +00:00

docs(release): the documents say what 1.1.1 does, and the package manifests verify the file they name 821425f931

Statements the release reviews of 1.1.1 found untrue at this commit, and two
gaps in the release tooling.

- Threat model: the version reviewed; an installed build contacts
  git.kof22.com for updates; the binaries are signed (the accepted risks named
  them unsigned) and T1 with the Scoop part of T2 is what is accepted; T2 and
  T11 say what ADR 0009 changed.
- SECURITY.md names 1.1.x as the supported line.
- README: the beta is a separate app with its own accounts; parallelism is
  under Sync options, after loading; the buttons have the names on screen; the
  app is built unpackaged, with no Developer Mode. CONTRIBUTING the same.
  docs/CLI.md shows a current version.
- RELEASING.md: on which forge the packaging commit lands; the check that the
  server answers from outside comes before anything is tagged; a version that
  moves the updater is rehearsed with two prereleases read from that server;
  the engine package is numbered by its own public surface.
- Update-PackageManifests.ps1 downloads the file the manifests will name and
  compares its SHA-256 with the built one's, instead of asking only whether
  the URL answers; and writes the Scoop manifest with the repository's line
  endings.
- One vault test stored an entry in the credential namespace the installed
  app uses. It uses two test scopes now (#161).

Closes #183

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

james.maes commented

2026-11-11 06:05:16 +00:00

Gates on 821425f, started from PowerShell: build with warnings as errors 0, engine 1,141, CLI 212, line coverage 100% on the three gated assemblies, format clean, UI suite 13 of 13. PSScriptAnalyzer clean over .github/scripts.

One earlier run failed in VaultTests.CredentialManager_RoundTrips_AgainstTheRealStore, a test this change does not touch: it passed three times alone and in the full run after. The machine was under load from other test runs; noted in #190.

🤖 Generated with Claude Code

Gates on 821425f, started from PowerShell: build with warnings as errors 0, engine 1,141, CLI 212, line coverage 100% on the three gated assemblies, format clean, UI suite 13 of 13. PSScriptAnalyzer clean over `.github/scripts`. One earlier run failed in `VaultTests.CredentialManager_RoundTrips_AgainstTheRealStore`, a test this change does not touch: it passed three times alone and in the full run after. The machine was under load from other test runs; noted in #190. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes referenced this issue from a commit

2026-11-11 06:14:22 +00:00

docs(release): second review of #199: the runbook no longer contradicts itself, and says which file the manifests are made from

james.maes added 1 commit 2026-11-11 06:14:22 +00:00

docs(release): second review of #199 : the runbook no longer contradicts itself, and says which file the manifests are made from 271090571f

- The copy of a release to git.kof22.com is a numbered step, with the
  attestation check before it; the verification step says what is checked
  there and from where, and no longer tells to merge a pull request on GitHub.
- winget: the job stays switched off while it would submit the GitHub URL;
  the command for an update by hand is given.
- A hand run of Update-PackageManifests.ps1 takes the CLI zip from the GitHub
  release: given the file from git.kof22.com it would compare that file with
  itself.
- The dev edition's installer is named as the section on the dev edition
  names it.
- Threat model: T11 is not 'Mitigated' as a whole while the copy is manual;
  T2 says when Chocolatey's hash is computed in CI.

Refs #183

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

james.maes commented

2026-11-11 06:14:22 +00:00

Second review (the four release reviewers, each on their own area): the corrections hold. Their remaining points on this change are fixed in 2710905: the runbook contradicted itself about where the packaging pull request is merged and about winget; the copy to git.kof22.com was not a numbered step; nothing said which zip a hand run of the manifests script is given (it must be the built one from the GitHub release, or the check compares the server's file with itself); T11 was still marked mitigated as a whole. Documents only since the gated commit.

🤖 Generated with Claude Code

Second review (the four release reviewers, each on their own area): the corrections hold. Their remaining points on this change are fixed in 2710905: the runbook contradicted itself about where the packaging pull request is merged and about winget; the copy to git.kof22.com was not a numbered step; nothing said which zip a hand run of the manifests script is given (it must be the built one from the GitHub release, or the check compares the server's file with itself); T11 was still marked mitigated as a whole. Documents only since the gated commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes merged commit 1915ce2f94 into main

2026-11-11 06:20:48 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#199